| name | drupal-security-review |
| description | Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps. |
Drupal Security Review Skill
Purpose
Use this skill to perform focused security reviews for Drupal 11 custom modules and themes.
When to apply
- Reviewing pull requests before merge.
- Auditing custom code for common web vulnerabilities.
- Preparing release readiness checks.
Review checklist
- Input handling: Validate and sanitize all external input.
- Output escaping: Escape output in Twig and PHP render logic.
- Database safety: Use query builder or placeholders in all SQL operations.
- Access control: Confirm route, entity, and operation permissions are enforced.
- Secrets and config: Ensure credentials are never committed and sensitive config is protected.
Common anti-patterns to flag
- Direct SQL string concatenation with user data.
- Unescaped raw markup in render arrays.
- Trusting
$_GET, $_POST, or request payloads without validation.
- Debug leftovers (
var_dump, kint, dpm) in production paths.
Useful validation commands
rg "(var_dump|dpm\(|kint\()" web/modules/custom web/themes/custom
rg "\$_(GET|POST|REQUEST)" web/modules/custom web/themes/custom
